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What is claimed is: 

1 . (Currently Amended) A method of tracking incoming transmissions comprising: 
identifying an incoming transmission including at least one identifiable portion; 
computing, for each identifiable portion in the incoming transmission, a fingerprint 

indicative of the at least one identified portion, the fingerprint being substantially unique 
to the at ieast one identified portion; 

storing the computed fingerprint to generate a set of stored fingerprints; 

receiving a set of comparison fingerprints corresponding to a_known p@rti&B8 

portion of the incoming transmission , the set of comparison fingerprints being 

predetermined; and 

comparing the set of s tored fingerprints to the set of comparison fingerprints to 
identify stored fingerprints matching at ieast one of the set of comparison fingerprints 
and, if a match is found, identifying 4>e-a„previous incoming transmission corresponding 
to tl^amatching stored fingerprint of the set of stored fingerprints . 

2. (Currently Amended) The method of claim 1 wherein storing further comprises 
selectively storing, if the incoming transmission does not correspond to the set of 
comparison fingerprints, at least one fingerprint corresponding to the at least one 
identifiable portionp ortiQne of the incoming transmission. 

3. (Original) The method of claim 1 wherein computing the fingerprint value 
includes determining a signature and comparing comprises signature matching. 

4. (Original) The method of claim 1 further comprising receiving at least one 
successive set of comparison fingerprints, and iteratively comparing the successive sets 
of comparison fingerprints to the stored fingerprints, wherein if a match is found, 
identifying a distribution set of the incoming message corresponding to the matching 
stored fingerprint and transmitting an indication of the match to the distribution set. 
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5. (Currently Amended) The method of claim 1 wherein the set of comparison 
fingerprints are virus signatures computed from known undesirable transactions. 

6. (Currently Amended) The method of claim 1 further comprising 

storing an indication of the subsequent disposition of the incoming transmission; 
receiving a subsequent set of comparison fingerprints, the subsequent set 

indicative of refinements to the known penk^R&portjon of the incoming Jransmsssign; 

matching the subsequent set to the stored fingerprints; 

determining, based on the matching of the subsequent set, if the subsequent set 
of comparison fingerprint is indicative of an undesirable portion in the incoming 
transmission; and 

selectively performing, based on the determining, a remedial action in response 
to the subsequent disposition. 

7. (Original) The method of claim 6 wherein the subsequent disposition includes 
transmitting the incoming transmission to a list of successive recipients; and the 
remedial action is sending a notification to the successive recipients indicative of the 
matching incoming transmission. 

8. (Original) The method of claim 1 wherein the incoming transmission further 
comprises a series of potentially harmful network transmissions, each of the incoming 
transmission operable to include malicious code, wherein the subsequent disposition 
includes delivery to at least one successive recipient and remedial action includes 
determining the successive recipients from the stored successive disposition and 
notifying each of the successive recipients. 

9. (Original) The method of claim 1 wherein the determined undesirable portion did 
not indicate undesirable transmissions based on the comparing of a previous set of 
comparison fingerprints. 
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1 0. (Original) The method of claim 1 further comprising demarcating the incoming 
transmission into segments, each segment operable to yield a fingerprint, wherein 
comparing further comprises comparing each value in the set of comparison fingerprints 
with at least one of the segments. 

1 1 . (Original) The method of claim 1 further comprising 

identifying a segment type of each segment, the segment type corresponding to 
the content included in the segment; and 

categorizing each of the segments according to a heuristic, the heuristic 
indicative of a likelihood of the categorized segment including an undesirable 
transmission. 

12. (Original) The method of claim 1 1 further comprising: 
identifying a risk assessment of each of the segment types; and 

storing the segment according to the identified risk assessment, storing further 
including identifying a duration. 

13. (Original) The method of claim 12 wherein storing the segments further 
comprises storing the content of the segment with the corresponding fingerprint. 

14. (Original) The method of claim 1 wherein the undesirable portions are selected 
from the group consisting of viruses, worms and Trojan horses included as an 
attachment according to an established mail protocol. 

15. (Withdrawn) A method of computer virus prevention comprising: 
maintaining a first set of undesirable content definitions, the set of undesirable 

content definitions indicative of malicious transmissions; 

comparing incoming transmissions to the first set of undesirable content 
definitions, the comparison result identifying malicious transmissions; 
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computing an artifact indicative of the incoming transmission, the artifact 
operable to identify the corresponding incoming transmission and distinguishable from 
artifacts corresponding to other incoming transmissions; 

selectively storing, based on the comparison of the first set, if the incoming 
transmission does not correspond with the first set of undesirable content definitions, at 
least one artifact corresponding to the incoming transmission; 

receiving an indication of a malicious segment; 

merging the indication of the malicious segment with the first set of undesirable 
content definitions to generate a second set of undesirable content definitions; 

comparing the second set of undesirable content definitions with the artifacts 
corresponding to the stored incoming transmissions; and 

determining, based on the comparing of the second set of undesirable content 
definitions to the stored artifacts of previously processed transmissions, the incoming 
transmissions including malicious segments. 

16. (Withdrawn) The method of claim 16 wherein the incoming transmission is not 
indicated as including a malicious segment by the first set of undesirable content 
definitions and matches a successive set of undesirable content definitions. 

1 7. (Currently Amended) A data communications device for tracking incoming 
transmissions comprising: 

a processor comprising: 

a server having a scanner operable to identify an incoming transmission 
including at least one identifiable portion; 

a segmenter operable to compute for each identifiable portion in the 
incoming transmission, a fingerprint indicative of the at ieast one identified portion, the 
fingerprint being substantially unique to the at least one identified portion; 

a repository operable to store the computed fingerprints as a set of stored 
fingerprints, the repository, the server further operable to receive a set of comparison 
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fingerprints corresponding to a. known pef&ei ^Qjtbn„.Gtthe.jn the 
set of comparison fingerprints being predetermined; and 

a comparator operable to compare the set of stored fingerprints to the set 
ofcomparison fingerprints to identify stored fingerprints matching any of the set of 
comparison fingerprints and, if a match is found, identifying fee-a_previously processed 
incoming transmission corresponding to #i-e-a matching stored fingerprin t of the set of 
stored fingerprints . 

18. (Currently Amended) The data communications device of claim 1 7 wherein the 
repository further includes stored fingerprints including at least one fingerprint 
corresponding to the at least one identifiable portion s eptiofts of the incoming 
transmission. 

1 9. (Original) The data communications device of claim 1 7 wherein the segmenter is 
further operable to compute the fingerprint value by determining a signature and the 
comparator is operable to compare fingerprints via signature matching. 

20. (Original) The data communications device of claim 17 wherein the mail server 
is in communication with a virus detection determiner and is operable to receiving at 
least one successive set of comparison fingerprints from the virus detection determiner, 
and further operable to iteratively compare the received successive set of comparison 
fingerprints to the stored fingerprints, and responsively to a match, identify a distribution 
set of the incoming message corresponding to the matching stored fingerprint and 
transmitting an indication of the match to the distribution set. 

21 . (Currently Amended) The data communications device of claim 1 7 wherein the 
set of comparison fingerprints are virus signatures computed from known undesirable 
transactions. 
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22. (Currently Amended) The data communications device of claim 1 7 wherein the 
repository is operable to store an indication of the subsequent disposition of the 
incoming transmission, the mail server further operable to: 

receive a subsequent set of comparison fingerprints, the subsequent set 
indicative of refinements to the known gertiOBsportion of the incoming transmission; 




match the subsequent set to the stored fingerprints; 

determine, based on the matching of the subsequent set, if the subsequent set of 
comparison fingerprint is indicative of an undesirable portion in the incoming 
transmission; and 

selectively perform, based on the determining, a remedial action in response to 
the subsequent disposition. 

23. (Original) The data communications device of claim 22 wherein the mail server 
is further operable to transmitting the incoming transmission to a list of successive 
recipients, and sending a notification to the successive recipients indicative of the 
matching incoming transmission. 

24. (Original) The data communications device of claim 17 wherein the incoming 
transmission further comprises a series of potentially harmful network transmissions, 
each of the incoming transmission operable to include malicious code, wherein the 
disposition reference is operable to store an indication of delivery to at least one 
successive recipient. 

25. (Original) The data communications device of claim 17 wherein the determined 
undesirable portion did not indicate undesirable transmissions based on the comparing 
of a previous set of comparison fingerprints. 




26. (Original) The data communications device of claim 17 wherein the segmenter is 
operable to demarcate the incoming transmission into segments, each segment 
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operable to yield a fingerprint, wherein the comparator is operable to compare each 
value in the set of comparison fingerprints with at least one of the segments. 

27. (Original) The data communications device of claim 26 wherein the segmenter is 
operable to: 

identify a segment type of each segment, the segment type corresponding to the 
content included in the segment; and 

categorize each of the segments according to a heuristic, the heuristic indicative 
of a likelihood of the categorized segment including an undesirable transmission. 

28. (Original) The data communications device of claim 27 wherein the segmenter is 
further operable to identify a risk assessment of each of the segment types, and the 
stored fingerprints are operable to storing the segment according to the identified risk 
assessment, storing further including identifying a duration. 

29. (Original) The data communications device of claim 28 wherein the stored 
segments further comprises the data content of the segment with the corresponding 
fingerprint. 

30. (Currently Amended) A computer program product having a computer readable 
medium operable to store computer program logic embodied in computer program code 
encoded thereon for tracking incoming transmissions comprising: 

computer program code for identifying an incoming transmission including at 
least one identifiable portion; 

computer program code for computing, for each identifiable portion in the 
incoming transmission, a fingerprint indicative of the at jea„sto ne,,identified portion, the 
fingerprint being substantially unique to the at least one identified portion; 

computer program code for storing the computed fingerprint to generate a set of 
stored fingerprints; 
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computer program code for receiving a set of comparison fingerprints 
corresponding to known f^feRsportion of the incoming transmission, the set of 
comparison fingerprints being predetermined; and 

computer program code for comparing the set of stored fingerprints to the sej of 
comparison fingerprints to identify stored fingerprints matching any-Ol^l£.ssLfi! 
comparison fingerprints and, if a match is found, identifying #48--a..previously received 
incoming transmission corresponding to tie- a matching stored fingerprin t of the set of 

slsi^lJloagisdiils- 

31 . (Canceled) 

32. (Currently Amended) A data communications device for tracking incoming 
transmissions comprising: 

a processor comprising : 

ajmeans for identifying an incoming transmission including at least one 
identifiable portion; 

ajmeans for computing, for each identifiable portion in the incoming 
transmission, a fingerprint indicative of the aUeasiOQ© identified portion, the 
fingerprint being substantially unique to the at least one identified portion; 
means for storing the computed fingerprint to generate a set of stored 
fingerprints; 

ajmeans for receiving a set of comparison fingerprints corresponding to 
known fierfe^sportion of the Incoming transmission, the set of c omparison 
fingerprints being predetermined; and 

ajmeans for comparing the set of stored fingerprints to the jseiof 
comparison fingerprints to identify stored fingerprints matching any of the set of 
comparison fingerprints and, if a match is found, identifying tne- apreviously 
received incoming transmission corresponding to the matching stored fingerprint 
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33. (New) The method of claim 1 , wherein the identifying a previous incoming 
transmission corresponding to a matching stored fingerprint of the set of stored 
fingerprints is a retroactive analysis of a previously accepted transmission. 

34. (New) The data communications device of claim 17, wherein identifying a 
previously processed incoming transmission corresponding to a matching stored 
fingerprint of the set of stored fingerprints is a retroactive analysis of a previously 
accepted transmission. 



